Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll
- Size 8.9MB
- Sample260925-gfalka1dkc
- SHA256 cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d
- MD5 d9be89d28ee264caa143dca8ff564677
- SHA1 72b2a50b8d7df065e6f7bcaf9205adf9d61fa9e5
- SHA512 e301ebc1835bdfbaba6b4da5d00b2067556e2d9732b93fca4636413fa3f376ab0468b5a86a443cb13fb337bc2188e67289975aa172b182d586bfe6a5f02b7e1b
- SSDEEP 196608:oqo0R5Sm4tJXN7iFn6u9LrX8HvkdF3/nR:oU7SmE969LryvkD/nR
- TLSH T16596DF466EE8C0B9C5E6C03DC6278A9BD3F178411933C7DF56954A0A2F337528F2A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 3204 rundll32.exe 8 3204 rundll32.exe 9 3204 rundll32.exe 10 3204 rundll32.exe 11 3204 rundll32.exe 12 3204 rundll32.exe 15 3204 rundll32.exe 18 3204 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe 3204 rundll32.exe - Suspicious behavior: LoadsDriver 47 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3204 rundll32.exe Token: SeIncBasePriorityPrivilege 3204 rundll32.exe Token: SeLoadDriverPrivilege 3204 rundll32.exe Token: SeTakeOwnershipPrivilege 3204 rundll32.exe Token: SeTcbPrivilege 3204 rundll32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc4db45a3a806cee8e48a329d2184a36b846517f21f429f0fe0b63689951426d.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:2792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\SyYdfuzBlTYfsBZu.eDt25-6-44
- Size 526KB
- SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61
- MD5 10b3049f4a954665512eca5d24728c89
- SHA1 172c5ce3afab6d63fe12a7e036f20271b9d09c13
- SHA512 0e6e8a93bdc2f5523b05c77cfc110d91f3b0f7763500e4c9f60989aeb4d86805bc985e01779014df63a57e944e6d138a9fc3879bf26d853a1167c8c7193699d7
- SSDEEP 6144:mERwg6i21P20M6NqWhUOqLDtQrPxXfuEu1rHP3gk9fKgBb/PaeO:fwg6i21O0p49OwQr5mEu1N9ds
- TLSH T1C2B4B059D3A108A6F167D07FCAA7C55AEAB27888974086DF42B4CD855F27BF0F138342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SyYdfuzBlTYfsBZu.eDt25-6-44.pak
- Size 526KB
- SHA256 1149259132bfa53de9f728edcc8c8ac2906a459e2c52200ac0cbe7708bfbcdde
- MD5 4e5f2d6780402cf486bdcf1cd1f579d1
- SHA1 d44e896d1fb9214851c2bbf3c274f6aaa04cb8a6
- SHA512 1f2c55eb3ffb61ef678f21949aa8c4dda283a1d83a04f87c48eabff2e2636ca1132b0c67a8e9d46aa2572e98adef561b6caac7f60c0cbf9461add0e6b675175f
- SSDEEP 12288:M5/OUgMID2Q6vtHZKjbcV16htEahPPFeAGp44jzPlIiCuf:AOUcDwvt5qcaXE4PdAlfGibf
- TLSH T105B4239C4715E41B45D2FCAC76B6B4EEC8FAA03432A1A07A1D448F4C125EB7B9B1E6C4
- MD5 SHA1 SHA512 SSDEEP TLSH